raviagheda/github-action-ssh.md

Last active September 14, 2025 01:02

Star (54) You must be signed in to star a gist
Fork (17) You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/raviagheda/c69ae5e884f4490b1af656dbd80c00dd.js"></script>
Save raviagheda/c69ae5e884f4490b1af656dbd80c00dd to your computer and use it in GitHub Desktop.

Download ZIP

Github Action with EC2 using SSH

Raw

github-action-ssh.md

Github Action with EC2 using SSH

Check this out on Dev.to

Configure SSH into aws ec2

How to handle SSH keys with ec2-github actions https://zellwk.com/blog/github-actions-deploy/

Declare these git secrets

SSH_PRIVATE_KEY
HOST_NAME / IP_ADDRESS
USER_NAME

name: Deploy

on:
  push:
    branches: [ dev ]

jobs:
  Deploy:
    name: Deploy to EC2
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v2 
      - name: Build & Deploy
        env:
            PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
            HOSTNAME: ${{secrets.SSH_HOST}}
            USER_NAME: ${{secrets.USER_NAME}}
      
        run: |
          echo "$PRIVATE_KEY" > private_key && chmod 600 private_key
          ssh -o StrictHostKeyChecking=no -i private_key ${USER_NAME}@${HOSTNAME} '

              # Now we have got the access of EC2 and we will start the deploy .
              cd /home/ubuntu/<PROJECT_DIRECTORY> &&
              git checkout dev &&
              git fetch --all &&
              git reset --hard origin/dev &&
              git pull origin dev &&
              sudo npm i &&
              sudo npm run build &&
              sudo pm2 stop ./dist/index.js &&
              sudo pm2 start ./dist/index.js
              '

marcodali commented Aug 14, 2023

USER_NAME: ${secrets.USER_NAME} is missing another opening and ending brackets

Author

raviagheda commented Aug 14, 2023 •

edited

Loading

USER_NAME: ${secrets.USER_NAME} is missing another opening and ending brackets

Thanks you @marcodali for highlighting it! :)
I've updated the gist.

MarinGarcia commented Aug 25, 2023

Nice ! thanks ! have been looking for this simple example for a long time

Author

raviagheda commented Aug 25, 2023

Nice ! thanks ! have been looking for this simple example for a long time

Thank you for the positive feedback @MarinGarcia ,
I've created a blog on it, should be easy to find this out now.
https://dev.to/raviagheda/github-action-with-ec2-using-ssh-4ej4

rashgaroth commented Oct 20, 2023

hii! how can you access env var(s) inside the string?

example:

ssh -o StrictHostKeyChecking=no -i private_key ${USER_NAME}@${HOSTNAME} '
echo $FOO
'

Arisfx commented Oct 25, 2023

May i ask how do you secure and whitelist what to reach your ec2's public ipv4? what you allowed on the ec2's security ingress group please?

giasuddin90 commented Oct 30, 2023

Very nice documentation, working fine. Thank you so much

aristeoibarra commented Nov 18, 2023

Thank you so much!

jsveron23 commented Nov 23, 2023

hii! how can you access env var(s) inside the string?

example:
ssh -o StrictHostKeyChecking=no -i private_key ${USER_NAME}@${HOSTNAME} '
echo $FOO
'

if you want to use it.
it helps

uses: appleboy/[email protected]

arif98741 commented Nov 30, 2023

Thansk for this awesome contributions 🔥 🔥 🔥 🔥 🔥 🔥

anandchakru commented Dec 26, 2023 •

edited

Loading

The only way for it to work is to open 22 from everywhere in EC2's SG? Closest I could get was this https://stackoverflow.com/a/72494602/234110 but still it sounds hacky

brandongallardoa commented Feb 5, 2024

but how can i allow github actions to connect to ec2 if the ip of the runner needs to be whilelisted?

jsveron23 commented Feb 5, 2024

but how can i allow github actions to connect to ec2 if the ip of the runner needs to be whilelisted?

      - name: Get VPC IP
        id: vpc-ip
        uses: haythem/[email protected]

      - name: Add IP to AWS Security group
        id: get-sg-rule-id
        run: |
          id=$(aws ec2 authorize-security-group-ingress \
            --group-id $SG \
            --ip-permissions IpProtocol=tcp,FromPort=22,ToPort=22,IpRanges="[{CidrIp=${IP},Description=${DESC}}]" \
            | jq --raw-output '.SecurityGroupRules | map(.SecurityGroupRuleId) | join("")')
          echo "::set-output name=rule_id::$id"
        env:
          IP: ${{ steps.vpc-ip.outputs.ipv4 }}/32
          DESC: 'Github'

akarsh-nagariya-trj commented Feb 5, 2024 •

edited

Loading

Hi how i can get ${{secrets.USER_NAME}} value after getting the ssh access so i need to access other secrets data like echo ${USER_NAME} but like this its not working

              cd /home/ubuntu/<PROJECT_DIRECTORY> &&
              git checkout dev &&
              git fetch --all &&
              git reset --hard origin/dev &&
              git pull origin dev &&
              sudo npm i &&
              echo ${USER_NAME}
              sudo npm run build &&
              sudo pm2 stop ./dist/index.js &&
              sudo pm2 start ./dist/index.js

joyobi-williams commented Feb 9, 2024

ssh -o StrictHostKeyChecking=no -i private_key ${USER_NAME}@${HOSTNAME} '

The above line will give you an error message.
What the error message tells you, you have a closing quotation mark ( ' ). Just remove the ' from the line above and you should be fine:

bajpangosh commented Apr 30, 2024

Run echo "$PRIVATE_KEY" > private_key && chmod 600 private_key
Warning: Permanently added '***' (ED25519) to the list of known hosts.
@: Permission denied (publickey).

how to handle private repositories?

kupilikula commented Apr 30, 2024

@joyyjoel That quotation mark is necessary. It's the opening quotation mark on the end of the ssh line. The closing quotation mark is at the very bottom of the workflow file. This sends that string within the quotation marks as a set of commands to be run after you ssh in to the ec2.

santoshsiva commented May 2, 2024

Run echo "$PRIVATE_KEY" > private_key && chmod 600 private_key Warning: Permanently added '' (ED25519) to the list of known hosts. _@*_: Permission denied (publickey).

how to handle private repositories?

I'm also facing the same

krishna2808 commented May 13, 2024

jobs:

build_and_test:
name: Build and Test
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: '3.10'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r blog/requirements.txt
- name: Run tests
run: python blog/manage.py test
deploy:
name: Deploy to EC2 on main branch push
# needs: build_and_test
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Deploy to Server 1
run: |
ssh -i ${{ secrets.EC2_SSH_KEY }} ubuntu@${{secrets.HOST_DNS}}
echo "Hello krishna"
env:
ACTIONS_RUNNER_DEBUG: false

   --------------------- error ---------------------------
  i have already pass secrets.EC2_SSH_KEY in github action variable. why same issue again again.
   
   
   Run ssh -i ***

Warning: Identity file -----BEGIN not accessible: No such file or directory.
ssh: Could not resolve hostname rsa: Temporary failure in name resolution
Error: Process completed with exit code 255.

claudiokerekes commented Jun 4, 2024 •

edited

Loading

LAST EDIT: FORGET IT, SECRET KEY TYPO

THANKS

Warning: Permanently added '***' (ED25519) to the list of known hosts.
Load key "private_key": error in libcrypto
@: Permission denied (publickey).

any sugestions??

jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: create key
env:
PRIVATE_KEY: ${{ secrets.SSH_KEY }}
run: |
echo "$PRIVATE_KEY" > private_key && chmod 600 private_key
- name: SSH and deploy
env:
HOSTNAME: ${{secrets.HOST}}
USER_NAME: ${{secrets.USER}}
run: |
ssh -o StrictHostKeyChecking=no -i private_key ${USER_NAME}@${HOSTNAME} '

        # Now we have got the access of EC2 and we will start the deploy .
        cd /home/ubuntu/inads-backend &&
        git checkout main &&
        git fetch --all &&
        git pull origin main &&
        docker-compose build &&
        docker-compose up -d
        '

Estanip commented Jun 11, 2024

Hi @raviagheda, Thanks for your input! Works fine! Could the git pull be unnecessary using git reset before?

Estanip commented Jun 11, 2024

Run echo "$PRIVATE_KEY" > private_key && chmod 600 private_key Warning: Permanently added '' (ED25519) to the list of known hosts. _@*_: Permission denied (publickey).
how to handle private repositories?

I'm also facing the same

Try this: https://docs.gitlab.com/ee/ci/ssh_keys/#troubleshooting

kiranjeetuix commented Jun 28, 2024 •

edited

Loading

Run echo "$PRIVATE_KEY" > private_key && chmod 600 private_key Warning: Permanently added '' (ED25519) to the list of known hosts. _@*_: Permission denied (publickey).
how to handle private repositories?

I'm also facing the same

How did you resolved it?

Estanip commented Jun 28, 2024

@kiranjeetuix try this: https://docs.gitlab.com/ee/ci/ssh_keys/#troubleshooting

ritik48 commented Dec 3, 2024

@raviagheda I want to access the env inside my ssh. how to do this ?
I am hosting my react app, and it requires REACT_APP_BACKEND as env
But, it's now working.


name: Deploy Frontend to EC2

on:
  push:
    branches: [ "deployment" ]

jobs:
  deploy:

    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Deploy to EC2
      env:
        EC2_HOST: ${{ secrets.EC2_HOST }}
        EC2_USER: ${{ secrets.EC2_USER }}
        EC2_KEY: ${{ secrets.EC2_KEY }}
        REACT_APP_BACKEND: ${{ secrets.BACKEND_URL }}
      run: |
        echo "${EC2_KEY}" > ec2-key.pem
        chmod 600 ec2-key.pem

        ssh -o StrictHostKeyChecking=no -i ec2-key.pem $EC2_USER@$EC2_HOST << 'EOF'

          export NVM_DIR="$HOME/.nvm"
          [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
          
          # Ensure the correct Node version is used
          nvm use 20.17.0

          cd /home/ubuntu/Portfolio/Portfolio-Frontend
  
          git pull origin deployment
          npm install

          npm run build
  
          sudo cp -r build/* /var/www/frontend

        EOF
        
        rm ec2-key.pem

braedonwatkins commented Aug 14, 2025

but how can i allow github actions to connect to ec2 if the ip of the runner needs to be whilelisted?

      - name: Get VPC IP
        id: vpc-ip
        uses: haythem/[email protected]

      - name: Add IP to AWS Security group
        id: get-sg-rule-id
        run: |
          id=$(aws ec2 authorize-security-group-ingress \
            --group-id $SG \
            --ip-permissions IpProtocol=tcp,FromPort=22,ToPort=22,IpRanges="[{CidrIp=${IP},Description=${DESC}}]" \
            | jq --raw-output '.SecurityGroupRules | map(.SecurityGroupRuleId) | join("")')
          echo "::set-output name=rule_id::$id"
        env:
          IP: ${{ steps.vpc-ip.outputs.ipv4 }}/32
          DESC: 'Github'

Forgive me if I'm misunderstanding but is the idea to piece by piece add new IPs permanently to the sec groups until we fully map all those to GitHub Runners? IDK how often these change or get released so I'm hesitant to do it this but it seems like the best solution.

raviagheda/github-action-ssh.md

Github Action with EC2 using SSH

Configure SSH into aws ec2

Declare these git secrets

sylitas commented Jul 3, 2023

Uh oh!

marcodali commented Aug 14, 2023

Uh oh!

raviagheda commented Aug 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MarinGarcia commented Aug 25, 2023

Uh oh!

raviagheda commented Aug 25, 2023

Uh oh!

rashgaroth commented Oct 20, 2023

Uh oh!

Arisfx commented Oct 25, 2023

Uh oh!

giasuddin90 commented Oct 30, 2023

Uh oh!

aristeoibarra commented Nov 18, 2023

Uh oh!

jsveron23 commented Nov 23, 2023

Uh oh!

arif98741 commented Nov 30, 2023

Uh oh!

anandchakru commented Dec 26, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

brandongallardoa commented Feb 5, 2024

Uh oh!

jsveron23 commented Feb 5, 2024

Uh oh!

akarsh-nagariya-trj commented Feb 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joyobi-williams commented Feb 9, 2024

Uh oh!

bajpangosh commented Apr 30, 2024

Uh oh!

kupilikula commented Apr 30, 2024

Uh oh!

santoshsiva commented May 2, 2024

Uh oh!

krishna2808 commented May 13, 2024

Uh oh!

claudiokerekes commented Jun 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Estanip commented Jun 11, 2024

Uh oh!

Estanip commented Jun 11, 2024

Uh oh!

kiranjeetuix commented Jun 28, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Estanip commented Jun 28, 2024

Uh oh!

ritik48 commented Dec 3, 2024

Uh oh!

braedonwatkins commented Aug 14, 2025

Uh oh!

raviagheda commented Aug 14, 2023 •

edited

Loading

anandchakru commented Dec 26, 2023 •

edited

Loading

akarsh-nagariya-trj commented Feb 5, 2024 •

edited

Loading

claudiokerekes commented Jun 4, 2024 •

edited

Loading

kiranjeetuix commented Jun 28, 2024 •

edited

Loading